topic How do you audit user logins on a forwarder? in Getting Data In

How do you audit user logins on a forwarder?

thisissplunk — Tue, 29 May 2018 21:12:16 GMT

I need to change the admin account password and want to make sure I don't break any automated tasks by doing it. How do I determine if the Splunk admin account has been used to log into and do things on the forwarder?

Re: How do you audit user logins on a forwarder?

somesoni2 — Tue, 29 Sep 2020 19:43:17 GMT

The forwarder should be logging user-login events into $Splunk_home/var/log/splunk/audit.log which are monitored and goes to index=_audit (logs are same as what you'll find on your search heads e.g. index=_audit sourcetype=audittrail action=login*). AFAIK, forwarding of _audit index data from forwarder is disabled from default, so you'd need to enable that and should be able to monitor user logins.

Re: How do you audit user logins on a forwarder?

thisissplunk — Tue, 29 May 2018 22:18:59 GMT

Great thank you. So if I don't see the admin account appearing in this year's audit log events I should be good?

Re: How do you audit user logins on a forwarder?

somesoni2 — Wed, 30 May 2018 01:41:34 GMT

Yes. But I'm not sure the logs will be available for that long. Check the retention period of _audit index.

Re: How do you audit user logins on a forwarder?

thisissplunk — Thu, 07 Jun 2018 22:08:13 GMT

Grepping through the splunk/var/log on the server in question did it.